mcp-proxy-adapter 4.1.1__py3-none-any.whl → 6.0.0__py3-none-any.whl

mcp_proxy_adapter/api/middleware/factory.py

@@ -0,0 +1,219 @@
+"""
+Middleware Factory for creating and managing middleware components.
+
+This module provides a factory for creating middleware components with proper
+configuration and dependency management.
+"""
+
+import logging
+from typing import Dict, Any, List, Optional, Type
+
+from fastapi import FastAPI
+
+from mcp_proxy_adapter.core.logging import logger
+from mcp_proxy_adapter.core.security_factory import SecurityFactory
+from .base import BaseMiddleware
+from .security import SecurityMiddleware
+from .error_handling import ErrorHandlingMiddleware
+from .logging import LoggingMiddleware
+
+
+class MiddlewareFactory:
+    """
+    Factory for creating and managing middleware components.
+    
+    Provides methods to create middleware components with proper configuration
+    and dependency management.
+    """
+    
+    def __init__(self, app: FastAPI, config: Dict[str, Any]):
+        """
+        Initialize middleware factory.
+        
+        Args:
+            app: FastAPI application
+            config: Application configuration
+        """
+        self.app = app
+        self.config = config
+        self.middleware_stack: List[BaseMiddleware] = []
+        
+        logger.info("Middleware factory initialized")
+    
+    def create_security_middleware(self) -> Optional[SecurityMiddleware]:
+        """
+        Create security middleware.
+        
+        Returns:
+            SecurityMiddleware instance or None if creation failed
+        """
+        try:
+            security_config = self.config.get("security", {})
+            
+            if not security_config.get("enabled", True):
+                logger.info("Security middleware disabled by configuration")
+                return None
+            
+            middleware = SecurityMiddleware(self.app, self.config)
+            self.middleware_stack.append(middleware)
+            
+            logger.info("Security middleware created successfully")
+            return middleware
+            
+        except Exception as e:
+            logger.error(f"Failed to create security middleware: {e}")
+            return None
+    
+    def create_error_handling_middleware(self) -> Optional[ErrorHandlingMiddleware]:
+        """
+        Create error handling middleware.
+        
+        Returns:
+            ErrorHandlingMiddleware instance or None if creation failed
+        """
+        try:
+            # Import here to avoid circular imports
+            from .error_handling import ErrorHandlingMiddleware
+            
+            middleware = ErrorHandlingMiddleware(self.app)
+            self.middleware_stack.append(middleware)
+            
+            logger.info("Error handling middleware created successfully")
+            return middleware
+            
+        except Exception as e:
+            logger.error(f"Failed to create error handling middleware: {e}")
+            return None
+    
+    def create_logging_middleware(self) -> Optional[LoggingMiddleware]:
+        """
+        Create logging middleware.
+        
+        Returns:
+            LoggingMiddleware instance or None if creation failed
+        """
+        try:
+            # Import here to avoid circular imports
+            from .logging import LoggingMiddleware
+            
+            middleware = LoggingMiddleware(self.app, self.config)
+            self.middleware_stack.append(middleware)
+            
+            logger.info("Logging middleware created successfully")
+            return middleware
+            
+        except Exception as e:
+            logger.error(f"Failed to create logging middleware: {e}")
+            return None
+    
+
+    
+    def create_all_middleware(self) -> List[BaseMiddleware]:
+        """
+        Create all required middleware components.
+        
+        Returns:
+            List of created middleware instances
+        """
+        middleware_list = []
+        
+        # Create security middleware (unified)
+        security_middleware = self.create_security_middleware()
+        if security_middleware:
+            middleware_list.append(security_middleware)
+        
+        # Create error handling middleware
+        error_middleware = self.create_error_handling_middleware()
+        if error_middleware:
+            middleware_list.append(error_middleware)
+        
+        # Create logging middleware
+        logging_middleware = self.create_logging_middleware()
+        if logging_middleware:
+            middleware_list.append(logging_middleware)
+        
+        logger.info(f"Created {len(middleware_list)} middleware components")
+        return middleware_list
+    
+
+    
+    def get_middleware_by_type(self, middleware_type: Type[BaseMiddleware]) -> Optional[BaseMiddleware]:
+        """
+        Get middleware instance by type.
+        
+        Args:
+            middleware_type: Type of middleware to find
+            
+        Returns:
+            Middleware instance or None if not found
+        """
+        for middleware in self.middleware_stack:
+            if isinstance(middleware, middleware_type):
+                return middleware
+        return None
+    
+    def get_security_middleware(self) -> Optional[SecurityMiddleware]:
+        """
+        Get security middleware instance.
+        
+        Returns:
+            SecurityMiddleware instance or None if not found
+        """
+        return self.get_middleware_by_type(SecurityMiddleware)
+    
+    def validate_middleware_config(self) -> bool:
+        """
+        Validate middleware configuration.
+        
+        Returns:
+            True if configuration is valid, False otherwise
+        """
+        try:
+            security_config = self.config.get("security", {})
+            
+            # Validate security configuration
+            if not SecurityFactory.validate_config(self.config):
+                logger.error("Security configuration validation failed")
+                return False
+            
+            # Validate middleware-specific configurations
+            if security_config.get("enabled", True):
+                # Check required fields for security middleware
+                auth_config = security_config.get("auth", {})
+                if not isinstance(auth_config, dict):
+                    logger.error("Auth configuration must be a dictionary")
+                    return False
+                
+                ssl_config = security_config.get("ssl", {})
+                if not isinstance(ssl_config, dict):
+                    logger.error("SSL configuration must be a dictionary")
+                    return False
+            
+            logger.info("Middleware configuration validation passed")
+            return True
+            
+        except Exception as e:
+            logger.error(f"Middleware configuration validation failed: {e}")
+            return False
+    
+    def get_middleware_info(self) -> Dict[str, Any]:
+        """
+        Get information about created middleware.
+        
+        Returns:
+            Dictionary with middleware information
+        """
+        info = {
+            "total_middleware": len(self.middleware_stack),
+            "middleware_types": [],
+            "security_enabled": False
+        }
+        
+        for middleware in self.middleware_stack:
+            middleware_type = type(middleware).__name__
+            info["middleware_types"].append(middleware_type)
+            
+            if isinstance(middleware, SecurityMiddleware):
+                info["security_enabled"] = True
+        
+        return info

mcp_proxy_adapter/api/middleware/logging.py

@@ -5,7 +5,7 @@ Middleware for request logging.
 import time
 import json
 import uuid
-from typing import Callable, Awaitable
+from typing import Callable, Awaitable, Dict, Any
 
 from fastapi import Request, Response
 
@@ -17,6 +17,17 @@ class LoggingMiddleware(BaseMiddleware):
     Middleware for logging requests and responses.
     """
     
+    def __init__(self, app, config: Dict[str, Any] = None):
+        """
+        Initialize logging middleware.
+        
+        Args:
+            app: FastAPI application
+            config: Application configuration (optional)
+        """
+        super().__init__(app)
+        self.config = config or {}
+    
     async def dispatch(self, request: Request, call_next: Callable[[Request], Awaitable[Response]]) -> Response:
         """
         Processes request and logs information about it.
@@ -43,7 +54,13 @@ class LoggingMiddleware(BaseMiddleware):
         url = str(request.url)
         client_host = request.client.host if request.client else "unknown"
         
-        req_logger.info(f"Request started: {method} {url} | Client: {client_host}")
+        # Check if this is an OpenAPI schema request (should be logged at DEBUG level)
+        is_openapi_request = "/openapi.json" in url
+        
+        if is_openapi_request:
+            req_logger.debug(f"Request started: {method} {url} | Client: {client_host}")
+        else:
+            req_logger.info(f"Request started: {method} {url} | Client: {client_host}")
         
         # Log request body if not GET or HEAD
         if method not in ["GET", "HEAD"]:
@@ -79,8 +96,12 @@ class LoggingMiddleware(BaseMiddleware):
             process_time = time.time() - start_time
             status_code = response.status_code
             
-            req_logger.info(f"Request completed: {method} {url} | Status: {status_code} | "
-                            f"Time: {process_time:.3f}s")
+            if is_openapi_request:
+                req_logger.debug(f"Request completed: {method} {url} | Status: {status_code} | "
+                                f"Time: {process_time:.3f}s")
+            else:
+                req_logger.info(f"Request completed: {method} {url} | Status: {status_code} | "
+                                f"Time: {process_time:.3f}s")
             
             # Add request ID to response headers
             response.headers["X-Request-ID"] = request_id
@@ -90,7 +111,12 @@ class LoggingMiddleware(BaseMiddleware):
         except Exception as e:
             # Log error
             process_time = time.time() - start_time
-            req_logger.error(f"Request failed: {method} {url} | Error: {str(e)} | "
-                            f"Time: {process_time:.3f}s")
+            
+            if is_openapi_request:
+                req_logger.debug(f"Request failed: {method} {url} | Error: {str(e)} | "
+                                f"Time: {process_time:.3f}s")
+            else:
+                req_logger.error(f"Request failed: {method} {url} | Error: {str(e)} | "
+                                f"Time: {process_time:.3f}s")
             
             raise 

mcp_proxy_adapter/api/middleware/mtls_adapter.py

@@ -0,0 +1,305 @@
+"""
+MTLS Middleware Adapter for backward compatibility.
+
+This module provides an adapter that maintains the same interface as MTLSMiddleware
+while using the new SecurityMiddleware internally.
+"""
+
+import logging
+from typing import Dict, List, Optional, Any, Callable, Awaitable
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+
+from fastapi import Request, Response
+from starlette.responses import JSONResponse
+
+from mcp_proxy_adapter.core.logging import logger
+from mcp_proxy_adapter.core.auth_validator import AuthValidator
+from mcp_proxy_adapter.core.role_utils import RoleUtils
+from mcp_proxy_adapter.core.certificate_utils import CertificateUtils
+from .base import BaseMiddleware
+from .security import SecurityMiddleware
+
+
+class MTLSMiddlewareAdapter(BaseMiddleware):
+    """
+    Adapter for MTLSMiddleware that uses SecurityMiddleware internally.
+    
+    Maintains the same interface as the original MTLSMiddleware for backward compatibility.
+    """
+    
+    def __init__(self, app, mtls_config: Dict[str, Any]):
+        """
+        Initialize mTLS middleware adapter.
+        
+        Args:
+            app: FastAPI application
+            mtls_config: mTLS configuration dictionary
+        """
+        super().__init__(app)
+        
+        # Store original configuration for backward compatibility
+        self.mtls_config = mtls_config
+        self.auth_validator = AuthValidator()
+        self.role_utils = RoleUtils()
+        self.certificate_utils = CertificateUtils()
+        
+        # Extract configuration
+        self.enabled = mtls_config.get("enabled", False)
+        self.ca_cert_path = mtls_config.get("ca_cert")
+        self.verify_client = mtls_config.get("verify_client", True)
+        self.client_cert_required = mtls_config.get("client_cert_required", True)
+        self.allowed_roles = mtls_config.get("allowed_roles", [])
+        self.require_roles = mtls_config.get("require_roles", False)
+        
+        # Create internal security middleware
+        self.security_middleware = self._create_security_middleware()
+        
+        logger.info(f"MTLSMiddlewareAdapter initialized: enabled={self.enabled}, "
+                   f"verify_client={self.verify_client}, "
+                   f"client_cert_required={self.client_cert_required}")
+    
+    def _create_security_middleware(self) -> SecurityMiddleware:
+        """
+        Create internal SecurityMiddleware with MTLSMiddleware configuration.
+        
+        Returns:
+            SecurityMiddleware instance
+        """
+        # Convert MTLSMiddleware config to SecurityMiddleware config
+        security_config = {
+            "security": {
+                "enabled": self.enabled,
+                "auth": {
+                    "enabled": False
+                },
+                "ssl": {
+                    "enabled": self.enabled,
+                    "cert_file": None,
+                    "key_file": None,
+                    "ca_cert": self.ca_cert_path,
+                    "min_tls_version": "TLSv1.2",
+                    "verify_client": self.verify_client,
+                    "client_cert_required": self.client_cert_required
+                },
+                "permissions": {
+                    "enabled": self.require_roles,
+                    "roles_file": None,
+                    "default_role": "user",
+                    "deny_by_default": True
+                },
+                "rate_limit": {
+                    "enabled": False
+                }
+            }
+        }
+        
+        return SecurityMiddleware(self.app, security_config)
+    
+    async def before_request(self, request: Request) -> None:
+        """
+        Process request before calling the main handler.
+        
+        Args:
+            request: FastAPI request object
+        """
+        if not self.enabled:
+            return
+        
+        try:
+            # Use SecurityMiddleware for validation
+            await self.security_middleware.before_request(request)
+            
+            # Additional MTLS-specific processing
+            client_cert = self._extract_client_certificate(request)
+            if client_cert:
+                # Store certificate and roles in request state for backward compatibility
+                request.state.client_certificate = client_cert
+                request.state.client_roles = self._extract_roles_from_certificate(client_cert)
+                request.state.client_common_name = self._get_common_name(client_cert)
+                
+                logger.debug(f"mTLS authentication successful for {request.state.client_common_name} "
+                            f"with roles: {request.state.client_roles}")
+            
+        except Exception as e:
+            logger.error(f"mTLS authentication failed: {e}")
+            raise
+    
+    def _extract_client_certificate(self, request: Request) -> Optional[x509.Certificate]:
+        """
+        Extract client certificate from request.
+        
+        Args:
+            request: FastAPI request object
+            
+        Returns:
+            Client certificate or None
+        """
+        # Check for certificate in request headers
+        cert_header = request.headers.get("X-Client-Cert")
+        if cert_header:
+            try:
+                cert_data = cert_header.encode('utf-8')
+                return x509.load_pem_x509_certificate(cert_data)
+            except Exception as e:
+                logger.warning(f"Failed to parse certificate from header: {e}")
+        
+        # Check for certificate in request state (from SSL context)
+        if hasattr(request, 'client') and hasattr(request.client, 'get_extra_info'):
+            cert = request.client.get_extra_info('ssl_object')
+            if cert:
+                return cert
+        
+        return None
+    
+    def _validate_client_certificate(self, cert: x509.Certificate) -> bool:
+        """
+        Validate client certificate.
+        
+        Args:
+            cert: Client certificate
+            
+        Returns:
+            True if valid, False otherwise
+        """
+        try:
+            # Basic validation
+            if not self.certificate_utils.is_certificate_valid(cert):
+                return False
+            
+            # CA validation if CA cert is provided
+            if self.ca_cert_path:
+                return self.certificate_utils.validate_certificate_chain(cert, self.ca_cert_path)
+            
+            return True
+            
+        except Exception as e:
+            logger.error(f"Certificate validation failed: {e}")
+            return False
+    
+    def _extract_roles_from_certificate(self, cert: x509.Certificate) -> List[str]:
+        """
+        Extract roles from client certificate.
+        
+        Args:
+            cert: Client certificate
+            
+        Returns:
+            List of roles
+        """
+        try:
+            # Extract from subject alternative names
+            roles = []
+            
+            # Check for roles in SAN
+            san = cert.extensions.get_extension_for_oid(x509.oid.ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
+            if san:
+                for name in san.value:
+                    if isinstance(name, x509.DNSName):
+                        if name.value.startswith("role="):
+                            role = name.value.split("=", 1)[1]
+                            roles.append(role)
+            
+            # Check for roles in subject
+            subject = cert.subject
+            for attr in subject:
+                if attr.oid.dotted_string == "2.5.4.3":  # Common Name
+                    if attr.value.startswith("role="):
+                        role = attr.value.split("=", 1)[1]
+                        roles.append(role)
+            
+            # Check allowed roles if specified
+            if self.allowed_roles:
+                roles = [role for role in roles if role in self.allowed_roles]
+            
+            return roles
+            
+        except Exception as e:
+            logger.error(f"Failed to extract roles from certificate: {e}")
+            return []
+    
+    def _get_common_name(self, cert: x509.Certificate) -> str:
+        """
+        Get common name from certificate.
+        
+        Args:
+            cert: Client certificate
+            
+        Returns:
+            Common name
+        """
+        try:
+            subject = cert.subject
+            for attr in subject:
+                if attr.oid.dotted_string == "2.5.4.3":  # Common Name
+                    return attr.value
+            return "unknown"
+        except Exception:
+            return "unknown"
+    
+    def _validate_access(self, roles: List[str]) -> bool:
+        """
+        Validate access based on roles.
+        
+        Args:
+            roles: List of client roles
+            
+        Returns:
+            True if access is allowed, False otherwise
+        """
+        if not self.require_roles:
+            return True
+        
+        if not roles:
+            return False
+        
+        # Check if any role is allowed
+        return any(role in self.allowed_roles for role in roles)
+    
+    def get_client_certificate(self, request: Request) -> Optional[x509.Certificate]:
+        """
+        Get client certificate from request state (backward compatibility).
+        
+        Args:
+            request: Request object
+            
+        Returns:
+            Client certificate or None
+        """
+        return getattr(request.state, 'client_certificate', None)
+    
+    def get_client_roles(self, request: Request) -> List[str]:
+        """
+        Get client roles from request state (backward compatibility).
+        
+        Args:
+            request: Request object
+            
+        Returns:
+            List of client roles
+        """
+        return getattr(request.state, 'client_roles', [])
+    
+    def get_client_common_name(self, request: Request) -> str:
+        """
+        Get client common name from request state (backward compatibility).
+        
+        Args:
+            request: Request object
+            
+        Returns:
+            Client common name
+        """
+        return getattr(request.state, 'client_common_name', 'unknown')
+    
+    def is_mtls_authenticated(self, request: Request) -> bool:
+        """
+        Check if request is mTLS authenticated (backward compatibility).
+        
+        Args:
+            request: Request object
+            
+        Returns:
+            True if mTLS authenticated, False otherwise
+        """
+        return hasattr(request.state, 'client_certificate') and request.state.client_certificate is not None